Why Wi-Fi is a different kind of target

Every other assessment in this series assumes you can reach the target over a network. Wi-Fi is the network, and that changes the game: the traffic is in the air, anyone in range can see the frames, and "in range" for a directional antenna is a lot further than the car park. You are not looking for an open port; you are looking at whether the encryption protecting that air is sound, whether the authentication can be captured and cracked offline, and whether a client can be tricked into connecting to something you control.

This is legitimate, necessary work on networks you own or are contracted to test — and it is a criminal offence on any other. Wireless makes that line easy to cross by accident, because your card will happily capture your neighbour's traffic along with your target's. The whole discipline below assumes written authorisation and a scope that names the SSIDs you may touch.

The one piece of hardware that matters

Before any tool, you need a wireless adapter that supports monitor mode and packet injection. Most built-in laptop cards do neither well. Monitor mode lets the card report every frame in the air rather than only those addressed to it; injection lets it transmit crafted frames, which several attacks below require. Adapters built on Atheros or Ralink chipsets (the common Alfa cards, for instance) are the usual choice precisely because their drivers support both. Without the right card, half of what follows silently does nothing, and that is the most common reason a beginner's wireless assessment produces no results.

Getting into monitor mode

The aircrack-ng suite is the foundation, and the first step is putting the interface into monitor mode:

Kill processes that will fight you for the interface.
sudo airmon-ng check kill
Put wlan0 into monitor mode — it becomes wlan0mon.
sudo airmon-ng start wlan0
See every network and client in range.
sudo airodump-ng wlan0mon

That last command is your radar. It lists access points with their BSSID (the AP's MAC), channel, encryption type, and signal strength, and below them the clients currently associated. Read the encryption column first: it tells you whether you are looking at WPA2, WPA3, or — still, in the wild — WEP, and that decides everything about the attack that follows.

The WPA2 attack, and what it actually captures

The classic WPA2-Personal assessment does not attack the encryption directly. It captures the four-way handshake — the exchange that happens when a client joins the network — and then attacks the password offline, at your own pace, on your own hardware. The handshake contains enough to verify a password guess without ever touching the network again.

Lock onto one AP and channel, and write captures to a file.
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
In a second terminal: nudge a connected client to reconnect, so we catch
the handshake it sends when it comes back.
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

That second command is a deauthentication attack: it forges frames telling a client it has been disconnected, so it reconnects and produces a fresh handshake for you to capture. It is also the most disruptive thing in the wireless toolkit — you are knocking real devices off the network, and on a production environment that is a genuine interruption you must have authorised. When airodump-ng shows WPA handshake: AA:BB:... in its header, you have what you need and can stop.

Then the password falls — or does not — offline:

aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

This is a dictionary attack, and it only ever finds passwords that are in your wordlist. A WPA2 network with a long random passphrase is, for practical purposes, safe from this — which is the finding you report when it holds. For serious cracking, convert the capture to hashcat's format (hcxpcapngtool) and let a GPU do the work; the companion Hashcat guide covers mode 22000.

PMKID: the attack that needs no client

Newer than the handshake capture, the PMKID attack grabs the material it needs directly from the access point, without waiting for a client to connect and without deauthenticating anyone. On an AP that is vulnerable to it, this is both faster and far quieter — no disruption, no client required.

sudo hcxdumptool -i wlan0mon -o capture.pcapng
then convert and crack the PMKID with hashcat mode 22000

Its existence is also why "just use a strong passphrase" remains the real defence: PMKID or handshake, the offline crack still comes down to whether the password is guessable.

Faster surveys with wifite

For assessing many networks rather than one, wifite orchestrates the aircrack-ng tools automatically — it will scan, capture handshakes and PMKIDs, and attempt cracks against the targets you select.

sudo wifite --kill
sudo wifite --wpa --dict /usr/share/wordlists/rockyou.txt

It is a time-saver, not a replacement for understanding what it does — every action it takes is one of the manual steps above, including the deauth, so the same authorisation and disruption caveats apply.

Rogue APs and the client-side attack

Not every wireless risk is about cracking the AP. An evil twin is a rogue access point broadcasting the same SSID as the legitimate one, hoping clients — or people — connect to it instead. bettercap is the tool for the man-in-the-middle side of an assessment once a client is talking to you:

sudo bettercap -iface wlan0
> net.probe on
> set arp.spoof.targets 192.168.1.0/24
> arp.spoof on

This tests a different control entirely: whether clients validate what they connect to, whether the network isolates clients from each other, and whether traffic that should be encrypted end-to-end actually is. On a corporate assessment it is often more revealing than the passphrase crack, because it measures how the humans and their devices behave, not just how strong a string is.

What the assessment is really checking

Pull the individual attacks up to the level of a report, and a wireless assessment answers a handful of questions:

• Encryption. WPA3 (SAE) resists the offline dictionary attack that WPA2 permits; WPA2-AES is acceptable with a strong passphrase; WPA2-TKIP is deprecated; WEP is broken and any WEP network is a finding on its own.
• Passphrase strength. If the handshake cracks against a wordlist, the passphrase is the problem, not the protocol.
• Enterprise auth. 802.1X/RADIUS (WPA2/3-Enterprise) replaces the shared passphrase with per-user credentials — the right answer for a corporate network, and worth checking is actually enforced rather than sitting alongside an open guest SSID.
• Client behaviour. Do devices connect to any SSID with the right name? Are clients isolated from one another? Is there a rogue AP already present?

Practising legally

You cannot practise this on "some network nearby" — that is the offence. Build a target you own: a spare home router you configure with a deliberately weak WPA2 passphrase, an old phone as the client. Deauth it, capture the handshake, crack your own password. That teaches the entire workflow with zero legal exposure, and it is the only honest way to get the reps in.

Running the analysis without a Wi-Fi rig

Capturing handshakes needs a physical radio in the room, so the capture step is always local — no cloud tool can sniff air it cannot reach. What does not need to be local is the cracking: once you have a .cap or .pcapng, converting and cracking it is a compute job. CyberSec Pro runs the aircrack-ng and hashcat side of the work — you upload the capture, choose the wordlist and mode, see the command before it runs, and watch progress stream back, with the job isolated in its own container and the capture treated as the sensitive material it is. The radio stays in your hands; the GPU work does not have to.